Quick Answers
If our data is hosted in a Tokyo cloud region, is it out of scope of Japan's cross-border transfer rules?
Not necessarily. The Personal Information Protection Commission (PPC) Q&A says that when a cloud service run by a foreign company handles personal data, providing data to it can be a provision to a third party in a foreign country even if the servers are in Japan. What matters is whether the operator handles the data, not only where the server sits.
What does a Japanese customer actually need from our answer?
Wording they can reuse. Even where using it is not a provision, the PPC Q&A expects companies using a foreign operator's cloud to make known, as part of their published security measures, the foreign country where the cloud provider is located and, where the servers are abroad, the country where they are located. Your answer should give them those country names and the measures behind them in a form they can paste into their own documents.

TL;DR

"Is the data stored in Japan?" is usually two questions: which country the servers are in, and which company, in which country, can handle the data. Under the PPC Q&A, a foreign operator that handles the data can trigger the rules on providing data to a third party in a foreign country even with servers in Tokyo, and even where it is not, customers are expected to publish the operator's country, and the server's country where the server is abroad. Answer with the region, your company's country and access locations, whether you handle the data and on what contractual basis, your sub-processors, and governing law. Keep the legal conclusion for Japanese counsel.

Key Takeaways

Why "Tokyo Region" Does Not Close the Question

Most overseas vendors answer the data-location question with a cloud region. All three major providers can support that answer: AWS lists Asia Pacific (Tokyo) and Asia Pacific (Osaka), Google Cloud lists Tokyo and Osaka, and Microsoft Azure lists Japan East and Japan West. A Japanese customer may then ask a follow-up, such as whether backups also stay within the two Japanese locations. That is a fair question, and the honest answer depends on your actual architecture: logs, backups, support tools and sub-processors can sit in other countries even when the primary database is in Tokyo.

The bigger gap is not technical. Japan's Act on the Protection of Personal Information (APPI) does not only look at where a server is. The Personal Information Protection Commission (PPC), Japan's privacy regulator, sets out the practical interpretation in its Q&A on the Act, and three of its answers explain most of the follow-up questions you will get.

What the PPC Q&A Says

Q7-53: it turns on whether the provider handles the data

According to the Q&A, whether storing personal data on a cloud service counts as "providing" it to the cloud provider does not depend on whether the stored data includes personal data. It depends on whether the provider is set up to handle that personal data. If the provider is set up not to handle it, the use is not a provision, and neither the individual's consent nor the duty to supervise a contractor applies. The Q&A gives contract terms stating that the provider will not handle the data, combined with appropriate access control, as an example of being set up not to handle it. Q7-54 adds that the customer still has to take appropriate measures as part of its own security obligations.

Q12-4: a server in Japan does not settle it

The Q&A then addresses a cloud service run by a company in a foreign country with servers in Japan. If that company handles the personal data, providing data to it can be a provision to a third party in a foreign country. The Q&A adds an exception: if the foreign company handles the data in Japan and is recognised as using the database for its business in Japan, it is not a provision to a third party in a foreign country. In other words, "our servers are in Tokyo" does not by itself take you out of the cross-border rules. Whether it is a provision depends on the facts, which is one more reason to say plainly who handles the data and from where.

Q10-25: the customer has to publish the countries

Even where using a foreign provider's cloud is not a provision, the Q&A says the customer must understand the personal data protection system of the provider's country and take security measures accordingly, and that the same applies when the server is in Japan. As part of the security measures it makes public, the customer is expected to state the name of the foreign country where the cloud provider is located and the name of the foreign country where the servers storing the personal data are located. This sits within the APPI's rules on what companies must make known about the personal data they hold (Article 32), which since the April 2022 amendments include how the company has understood the "external environment" when data is handled abroad.

Read together, the three answers explain the customer's email. They are not asking whether you are trustworthy in general. They need country names (where the provider is, and where the servers are if they are abroad) and a description of your measures, because those will appear in their own privacy and security disclosures.

If It Is a Transfer: Consent or Ongoing Checks

When providing data to you does count as a provision to a third party in a foreign country, Article 28 of the APPI applies. Under the PPC's guidelines on provision to third parties in foreign countries, the customer generally needs the individual's prior consent, unless the recipient is in a country the PPC has designated as having an equivalent system (currently the EU and the UK), the recipient has a system meeting the PPC's standards (often called "equivalent measures"), or another statutory exception applies. Note what the EU and UK designation means: it concerns a recipient located in those countries. A US company describing itself as GDPR-compliant is a separate matter under Article 28.

For consent obtained on or after April 1, 2022, the customer must first tell individuals the name of the destination country, information about that country's personal data protection system, and the measures the recipient takes. If it relies on equivalent measures instead, it has to check how the recipient is implementing them, and the relevant system in that country, on a regular basis (the guidelines say about once a year or more), and provide information about the measures when an individual asks. Either way, the customer will come back to you for material. The PPC has also published a survey of foreign countries' data protection systems that companies can use for the country information.

Our article on Japanese Trust Pages covers how to present the consent and equivalent-measures routes, and staff access locations, on a public page. This article focuses on the individual reply.

Why Japanese Buyers Ask So Carefully

In 2021 the PPC investigated a major messaging app operator after reports that staff at an overseas contractor could access user data. The PPC requested a report on March 19, carried out an on-site inspection from March 31, and issued guidance to LINE Corporation on April 23, 2021. The guidance centred on supervising contractors: considering whether access rights given to developers at contractors and subcontractors were necessary and appropriately limited, keeping and analysing access logs, and auditing regularly. It also found that the company's system for providing data to third parties in foreign countries was broadly in place but needed some improvement. This was guidance, not an order or a penalty. The PPC's own documents do not name the countries involved; those details came from press reports and the company's announcements at the time.

Since then, it is common for Japanese security teams to ask not only where data is stored but who can access it and from where. Larger companies are also used to formal frameworks: Japanese government procurement uses ISMAP, a scheme for assessing cloud services in advance, and financial institutions work with the industry security standards published by FISC. The Ministry of Internal Affairs and Communications' 2017 guideline on information disclosure for cloud services lists items such as the provider's head office location, the rules on disputes and the competent court, and the location of the data centre. Customer questionnaires often follow lists like these, so expect questions on governing law and jurisdiction alongside location.

An Answer Template Your Team Can Reuse

The template below is a starting point for sales, CS and security teams. Fill in the brackets from your actual architecture and contracts, and delete what does not apply. Have a fluent Japanese reader check the Japanese version before it goes out.

Answer template (English)

1. Where the data is stored: Customer data, including personal data, is stored in [AWS Asia Pacific (Tokyo)], Japan. Backups are stored in [Asia Pacific (Osaka), Japan]. Application logs are stored in [country].

2. Who operates the service: The service is provided by [Company], incorporated in [country]. [Japanese subsidiary, if any] handles [sales and support] in Japan.

3. Whether we handle personal data: [Our support and engineering staff in [countries] may access customer data only to [purpose], with access granted per request, logged and reviewed every [period].] or [Under Section [x] of our agreement, we do not handle personal data stored by the customer, and access to customer data is technically restricted by [control].]

4. Sub-processors: [Names, purposes and countries], listed at [URL]. We notify customers [x days] before adding a sub-processor.

5. Security measures: [Encryption at rest and in transit, access control, access logging, audits/certifications].

6. Governing law and jurisdiction: The agreement is governed by [law], with [court] as the competent court.

Japanese version

1. 保存場所：個人データを含むお客様データは、日本国内の［AWS アジアパシフィック（東京）リージョン］に保存しています。バックアップは［日本国内（大阪リージョン）］、アプリケーションのログは［国名］に保存しています。

2. 提供事業者：本サービスは［国名］法人の［会社名］が提供しています。日本国内での［営業・サポート］は［日本法人名］が担当しています。

3. 個人データの取扱い：［当社の［国名］のサポート・開発担当者は、［目的］に必要な場合に限りお客様データにアクセスすることがあります。アクセス権は申請ごとに付与し、記録を取得して［期間］ごとに確認しています。］または［契約書第［x］条により、当社はお客様が保存する個人データを取り扱いません。また、［手段］によりお客様データへのアクセスを技術的に制限しています。］

4. 再委託先：［名称・目的・所在国］は［URL］に掲載しています。追加する場合は［x日］前にお知らせします。

5. 安全管理措置：［保存時・通信時の暗号化、アクセス制御、アクセスログの取得、監査・認証］

6. 準拠法・管轄：契約の準拠法は［法］、管轄裁判所は［裁判所］です。

Why this shape: Items 1 and 2 give the customer the country names the PPC Q&A expects them to publish (the provider's country, and the server's country if it is abroad), and confirming that the servers are in Japan is useful to them too. Item 3 answers the question that decides whether a cross-border provision is involved, and it is honest either way. Items 4 to 6 cover what their questionnaire is likely to ask next.

Three Things Not to Say

"We use a Tokyo region, so cross-border rules do not apply."

Q12-4 says it can still be a cross-border provision where a foreign operator handles the data. Give the region as a fact and let the customer's counsel reach the conclusion.

"SaaS is not a provision, so no consent is needed."

Most SaaS vendors handle customer data in some way, for example in support. Q7-53 applies when the provider is set up not to handle the data. If you can say that, back it with the contract clause and access controls. If you cannot, say so and describe your measures.

"We are GDPR-compliant, so Japanese requirements are covered."

The EU and UK designation concerns recipients in those countries. It does not transfer to a company elsewhere because it follows the GDPR. Describe your own measures instead.

Checklist Before You Reply

  1. You have confirmed where every copy of the data sits: primary storage, backups, logs and support tools.
  2. You can name the country of each company that can access the data, including sub-processors.
  3. You know whether you handle the data, and you can point to the contract clause and access controls behind your answer.
  4. The reply states country names plainly, so the customer can reuse them in its own disclosures.
  5. Governing law and the competent court are stated, matching your contract.
  6. No one promises a legal conclusion on whether the customer needs consent; that is for their counsel.
  7. A fluent Japanese reader has checked the Japanese version, so it reads as a clear answer rather than a translation.

This article explains the general framework and is not legal advice. Confirm the position for your service and contracts with Japanese counsel.

Sources

Frequently Asked Questions

Do we have to host data in Japan to sell to Japanese companies?

Japanese law does not prohibit storing personal data abroad; it sets conditions. Some customers prefer or require hosting in Japan as a matter of policy, so ask what their rules say, and be ready to describe both where the data is stored and who handles it.

Our servers are in Tokyo. Why is the customer still asking about our home country?

Because under the PPC Q&A, a foreign company that handles the personal data can make it a provision to a third party in a foreign country even with servers in Japan, and even where it is not, the customer is expected to publish the provider's country, and the server's country where the server is abroad.

Can we say we do not handle the customer's personal data?

Only if it is true in practice and backed by your contract and access controls, which is the situation Q7-53 describes. If support or engineering staff can access the data, say so and describe the controls.

Should our answer include governing law and jurisdiction?

It helps. Japanese security questionnaires often ask about the provider's location, governing law and the competent court alongside data location, and the government's cloud disclosure guideline lists similar items.